# Why ssh-gen makes difference between PEM and PKCS8?

Correct me if I am wrong, but PKCS8 is format to store private key info. It could be binary-enoded (DER) or Base64 encoded (PEM).

man ssh-config

-m key_format
Specify a key format for the -i (import) or -e (export) conver‐
sion options.  The supported key formats are: “RFC4716” (RFC
4716/SSH2 public or private key), “PKCS8” (PEM PKCS8 public
key) or “PEM” (PEM public key).  The default conversion format
is “RFC4716”.

I am confused with "PKCS8 Public Key" (while RFC-5208 is "Private-Key Information Syntax Specification Version") but I also can't understand what is "PEM public key" here? PKCS8 could be PEM or DER. What does it mean?

• OpenSSH's terminology is seriously confus{ed,ing} here. What they call 'PKCS8' isn't PKCS#8 at all, but rather PEM encoding of the SubjectPublicKeyInfo structure defined by X.509 to handle multiple PKC algorithms, which is more conveniently available in tools.ietf.org/html/rfc5280#section-4.1.2.7 with the details mostly in rfc3279. This format is ASN.1 based, as is 'PEM' which is PKCS#1 as you found, while rfc4716 is based on the XDR-like format used in SSH protocol. – dave_thompson_085 May 5 '16 at 18:58
• I know this is old but how do i make sure convert it to the proper putty file or how do use keygen to create a file i can use with putty – user86133 Jan 11 at 1:45
• @user86133: the only keyfile format used by the putty program is PPK which OpenSSH does not support and in particular cannot create. But the putty package also includes another program puttygen which among other things can convert PPK keyfiles from or to OpenSSH files. On Windows it's a GUI and just looking at the menu options should be obvious, or you can click on Help. On Unix it's commandline with a man page in the long-standard Unix way which you should read. – dave_thompson_085 Jan 12 at 3:58

[foo@bar ~]$ssh-keygen -f .ssh/authorized_keys -e -m PEM -----BEGIN RSA PUBLIC KEY----- MIIBCgKCAQEApPGAMzobORnBJdPD0VvBif0cBkRC1KgTi4rDmscp+4F8Ke6nE/jE ..... rf/DnkvPoJPiRLBnyjmyWsQ0dWHnRbSZSwIDAQAB -----END RSA PUBLIC KEY----- And here is PKCS#8 [foo@bar ~]$ ssh-keygen -f .ssh/authorized_keys -e -m PKCS8